1 |
Hell Kerin, |
2 |
|
3 |
Thanks for the pointer, I will take my time in searching for that |
4 |
"attacking-loganalysis". |
5 |
Actually we are talking about proftp deamon analysed using |
6 |
/var/log/auth.log. |
7 |
|
8 |
Here is the /var/log/auth.log that is suppose to trigger BAN on fail2ban: |
9 |
|
10 |
Jul 31 23:43:41 fileserver proftpd[28423]: fileserver.mzalendo.net |
11 |
(124.205.130.15[124.205.130.15]) - USER mysql (Login failed): Incorrect |
12 |
password. |
13 |
Jul 31 23:43:41 fileserver proftpd[28423]: fileserver.mzalendo.net |
14 |
(124.205.130.15[124.205.130.15]) - USER mysql (Login failed): Incorrect |
15 |
password. |
16 |
Jul 31 23:43:42 fileserver proftpd[28423]: fileserver.mzalendo.net |
17 |
(124.205.130.15[124.205.130.15]) - USER mysql (Login failed): Incorrect |
18 |
password. |
19 |
Jul 31 23:43:42 fileserver proftpd[28423]: fileserver.mzalendo.net |
20 |
(124.205.130.15[124.205.130.15]) - Maximum login attempts (3) exceeded, |
21 |
connection refused |
22 |
Jul 31 23:43:42 fileserver proftpd[28423]: fileserver.mzalendo.net |
23 |
(124.205.130.15[124.205.130.15]) - FTP session closed. |
24 |
|
25 |
And here is the filter using regular expression that actually confirms |
26 |
how it has been missed: |
27 |
|
28 |
fail2ban-regex /var/log/auth.log |
29 |
/etc/fail2ban/filter.d/proftpd.conf|grep 124.205.130.15 |
30 |
|
31 |
Is it a normal routine that users have tweak those filters? |
32 |
|
33 |
GR |
34 |
mrfroasty |
35 |
|
36 |
|
37 |
|
38 |
Kerin Millar wrote: |
39 |
> 2009/8/2 mrfroasty <mrfroasty@×××××.com>: |
40 |
> |
41 |
>> Hello, |
42 |
>> |
43 |
>> I have setup iptables and fail2ban, but I am curios that this line of |
44 |
>> defense seem not to work and ban me if i do this: |
45 |
>> #wget ftp://mysql:xxxx@fileserver |
46 |
>> |
47 |
>> I have seen a script kido, doing that and firewall just didnt respond to |
48 |
>> him or atleast not on the logs that he had been banned when he tried that. |
49 |
>> The firewall does ban or respond if I do this: |
50 |
>> #wget ftp://foo:pass@fileserver |
51 |
>> |
52 |
>> Probably he could have been banned if used a different user, but not |
53 |
>> mysql...I am confused...any clue? :-D |
54 |
>> |
55 |
> |
56 |
> You haven't provide any pertinent background information (ftp daemon |
57 |
> in use, log message which is expected to trigger action, details of |
58 |
> the fail2ban filter and so forth), which makes it rather difficult to |
59 |
> take a view. My guess is that the particular filter you are using |
60 |
> contains a regex which matches log messages from the daemon which |
61 |
> convey only an invalid user, rather than an authentication failure in |
62 |
> general. If so, you would need to adjust the filter - or add an |
63 |
> additional one - so as to cover both cases. |
64 |
> |
65 |
> As a side note, do be careful when crafting the regular expressions |
66 |
> that form the basis of the filter. The slightest mistake can |
67 |
> potentially result in the tool being open to attack itself via log |
68 |
> injection. For more information on this topic, search for |
69 |
> "attacking-loganalysis.html" via Google and view the cached copy; the |
70 |
> original article seems to have disappeared from the ossec.net site. |
71 |
> |
72 |
> Cheers, |
73 |
> |
74 |
> --Kerin |
75 |
> |
76 |
> |
77 |
> |
78 |
|
79 |
|
80 |
-- |
81 |
Extra details: |
82 |
OSS:Gentoo Linux |
83 |
profile:x86 |
84 |
Hardware:msi geforce 8600GT asus p5k-se |
85 |
location:/home/muhsin |
86 |
language(s):C/C++,VB,VHDL,bash,PHP,SQL,HTML,CSS |
87 |
Typo:40WPM |
88 |
url:http://www.mzalendo.net |